Access and identity
Who can log in. Who can connect.
Protect accounts with a Passkey or two-factor verification, and approve the source IP of each device. When a device is disabled, revoke its connection configuration separately.
Learn about account securityAccount login, protecting the management entry point.
Choose a login method, verify again before changes.
Sign in with a Passkey, or add TOTP two-factor verification to password sign-in. Re-verify your identity before adding or changing a sign-in method; the security page shows the current session's authentication method and expiration time.
The organization and the individual, verified separately.
The team submits the enterprise information for review, and each member handles their own documents and real-person verification. Historical document verification and the current liveness and face comparison are recorded separately, and the results of other members are not shared.
Networks and devices, authorized separately.
Changed networks? Request admission for your current source.
Open the admission link from the device that needs access and authenticate; the Gateway identifies the actual public IPv4 address. Requests within quota are approved automatically, requests over the limit wait for an administrator to handle them, and source permissions have their own validity period.
When a device is deactivated, revoke the corresponding configuration.
Revoke an individual WireGuard, RouterOS or FortiGate configuration. After synchronization, the Gateway removes its connection identity and related routes and private-network permissions; other individual configurations stay connected.
Run into a problem? Trace it back through the records.
Ingress denied? Check the specific reason.
Gateway security events record the source, client, processing stage, reason, and time. Administrators can handle sources mistakenly blocked on the current Gateway, or block sources that no longer need access.
Who changed what? Check the account audit.
Trace back the action, object, and time of account changes, and review Relay creation requests, node service entitlements, and BYOP takeover records.
Where did access go? Check the egress audit.
The final Connector records the destination domain or IP, protocol, port, upload and download traffic, and time, so you can trace the corresponding business access.
Frequently asked questions.
Will signing out of my account deactivate device tunnels?
No. Signing out ends the console session in the current browser. Terminal connection profiles have their own identities; to deactivate a device's network connection, you must revoke it in the corresponding profile.
What is the difference between source admission and terminal revocation?
Source admission manages public IPv4 sources on the Gateway, mainly for AnyTLS and SOCKS5 proxy ingress; WireGuard and IPsec endpoints are managed through their configuration identities. Blocking a source and revoking an endpoint configuration affect different objects and cannot replace each other. Endpoint revocation is irreversible; a new configuration is needed to reconnect.
Do account audit and access audit show the same type of records?
Account audit traces management actions and resource requests. Access audit is recorded by the final Connector and covers destinations and access traffic. Gateway security events explain the processing stage and reason for an ingress connection. The three serve different purposes.